analyzing-packed-malware-with-upx-unpacker

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced unpacking workflow with explicit validation and recovery paths, but it is token-heavy: it inlines long scripts and explains basic concepts Claude already knows, and it fails to link the provided api-reference.md and agent.py bundle files that would offload that bulk.

Suggestions

Move the inline header-repair Python (Step 3) into scripts/ (e.g. scripts/repair_upx_headers.py) and the reusable detection logic into the existing scripts/agent.py, then reference them from the body instead of inlining ~80 lines.

Link references/api-reference.md from the Tools & Systems section ('See [api-reference.md](references/api-reference.md) for full UPX/DIE syntax') so the provided reference earns its place and the body can drop the duplicated command listings.

Trim the Key Concepts table entries for 'Packing', 'UPX', and 'Magic Bytes' to one line each or remove them, since they explain concepts Claude already knows; keep only UPX-specific terms like OEP and Import Reconstruction.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient and actionable but pads ~80 lines of inline Python (header-repair script, repeated entropy analysis in Steps 1 and 5) and a Key Concepts table explaining 'Packing', 'UPX', and 'Magic Bytes' that Claude already knows; not level 3 because those tokens do not all earn their place, and not level 1 because the core guidance is direct and not fluffy.	2 / 3
Actionability	Provides copy-paste-ready commands (`upx -d`, `diec`, `upx -t`), complete executable Python (pefile, struct), and a concrete x64dbg/Scylla step sequence, matching the 'fully executable code/commands' anchor.	3 / 3
Workflow Clarity	Five clearly sequenced steps with an explicit validation checkpoint in Step 5 (entropy, imports, file-size ratio) and a repair->retry->manual-unpack feedback loop in the Common Scenarios approach; not level 2 because validation is present and the error-recovery path is explicit.	3 / 3
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist but are never referenced from the body, while ~80 lines of inline Python that belongs in scripts/ stays inline; per the guideline to score against the actual bundle structure, this is 'some structure but references not signaled and content that should be separate is inline', not level 3.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description with concrete actions, explicit 'Use when...' triggers, and a distinct UPX-focused niche that would rarely conflict with sibling skills. The modified-header qualifier further sharpens its scope.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Identifies and unpacks UPX-packed malware samples', 'modified UPX magic bytes or headers that block automated decompression', 'recover the original executable for static analysis' — in third person, matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly answers what (identify/unpack/recover, including modified-header handling) and when (explicit 'Use when...' triggers), matching the 'clearly answers both what AND when with explicit triggers' anchor.	3 / 3
Trigger Term Quality	The 'Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress' clause plus 'packed binary for disassembly in Ghidra or IDA' covers natural terms an analyst would actually say; not the level below because it includes common variations beyond a single keyword.	3 / 3
Distinctiveness Conflict Risk	Narrow UPX-specific niche with modified-header edge case and tool-specific triggers (Ghidra/IDA) makes it unlikely to fire for the wrong skill; not level 2 because the triggers are specific rather than overlapping.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md
Commit: e612f49

Reviewed: about 10 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.